ATL::CComVariant has a handful of assignment operators. What I see in the implementation is that in assignment operators accepting LPCOLESTR, IUnknown* or IDispatch* the first action is to call Clear().
If the operator in invoked in such a way that a member variable of the same object is passed
CComVariant variant;
variant = L"string";
variant = variant.bstrVal;
(there're less dumb ways that will have the same effect) Clear() will release the encapsulated object and all the later actions on the now dangling pointer will result in undefined behavior.
Am I correct or have I misunderstood anything?